Orb version
3.0.1
What happened
The install_dockerize command extracts the dockerize tarball in the current working directory (typically, the project root).
Starting with dockerize v0.11.0, the tarball includes README.md and LICENSE files in addition to the dockerize binary. This causes the project's own README.md and LICENSE to be silently overwritten during extraction.
$ curl -sL https://github.com/jwilder/dockerize/releases/download/v0.11.0/dockerize-linux-amd64-v0.11.0.tar.gz | tar tzf -
LICENSE
README.md
dockerize
The relevant code in install_dockerize.sh:
|
# download & install binary |
|
curl -O --silent --show-error --location --fail --retry 3 \ |
|
"$DOCKERIZE_BINARY_URL" |
|
|
|
tar xf "dockerize-$PLATFORM-$DOCKERIZE_VERSION.tar.gz" |
This extracts all files into the current directory without any path restriction.
Previous dockerize releases only contained the dockerize binary, so this was not an issue before.
$ curl -sL https://github.com/jwilder/dockerize/releases/download/v0.10.0/dockerize-linux-amd64-v0.10.0.tar.gz | tar tzf -
dockerize
Expected behavior
install_dockerize should not modify any project files.
Orb version
3.0.1
What happened
The
install_dockerizecommand extracts thedockerizetarball in the current working directory (typically, the project root).Starting with
dockerizev0.11.0, the tarball includesREADME.mdandLICENSEfiles in addition to thedockerizebinary. This causes the project's ownREADME.mdandLICENSEto be silently overwritten during extraction.The relevant code in
install_dockerize.sh:docker-orb/src/scripts/install_dockerize.sh
Lines 49 to 53 in e8af393
This extracts all files into the current directory without any path restriction.
Previous
dockerizereleases only contained thedockerizebinary, so this was not an issue before.Expected behavior
install_dockerizeshould not modify any project files.